Ocean Census Data Protection Policy
Document Owner: Data Protection Lead
Version: 2.0
Effective Date: 15.07.2026
Review Date: 15.07.2028
I. Purpose
Ocean Census is committed to protecting the privacy and security of the personal information entrusted to us.
This policy sets out how Ocean Census collects, uses, stores, shares and disposes of personal data in accordance with:
• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)
• Other applicable data protection legislation
This policy supports our Privacy Notice and applies to all processing of personal data undertaken by Ocean Census.
II. Scope
This policy applies to all personal data processed by Ocean Census, including information relating to:
• employees
• trustees
• volunteers
• consultants
• contractors
• job applicants
• donors
• prospective donors
• scientific collaborators
• Species Discovery Award applicants
• Expedition Discovery Award applicants
• Ocean Census NOVA users
• event participants
• suppliers
• website users
It applies to all permanent and temporary staff, trustees, volunteers and contractors who process personal information on behalf of Ocean Census.
III. Definitions
For the purposes of this policy:
Personal Data: Any information relating to an identified or identifiable individual.
Special Category Data: Personal information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health information or information concerning a person’s sex life or sexual orientation.
Processing: Any operation performed on personal data including collection, storage, use, disclosure, deletion or destruction.
Data Controller: Ocean Census Ltd.
Data Processor: Any organisation processing personal data on behalf of Ocean Census.
IV. Data protection principles
Ocean Census will ensure all personal data is processed in accordance with the UK GDPR principles.
We will ensure data is:
1. Processed lawfully, fairly and transparently.
2. Collected for specified, explicit and legitimate purposes.
3. Adequate, relevant and limited to what is necessary.
4. Accurate and kept up to date.
5. Retained only for as long as necessary.
6. Protected through appropriate technical and organisational security measures.
7. Managed in a way that demonstrates accountability.
V. Lawful bases for Processing
Ocean Census will only process personal data where there is a lawful basis.
Depending on the activity this may include:
• Consent
• Performance of a contract
• Compliance with a legal obligation
• Legitimate interests
• Protection of vital interests (where applicable)
Where special category data is processed, Ocean Census will identify both a lawful basis under Article 6 UK GDPR and an appropriate condition under Article 9 UK GDPR.
VI. Categories of personal data
Ocean Census may process:
• contact details
• professional information
• correspondence
• donor records
• financial records
• recruitment records
• event registrations
• accessibility requirements
• dietary requirements
• Ocean Census NOVA account information
• scientific attribution information
• website analytics
• IP addresses
• cookies
Only the minimum information necessary for each purpose will be collected.
VII. Accountability
Ocean Census will maintain appropriate governance arrangements including:
• Privacy by Design and Default
• Data Processing Agreements with third-party processors
• Regular policy reviews
• Staff awareness and training
• Internal procedures for managing data subject rights
VIII. Data sharing
Ocean Census does not sell personal information.
Information may be shared with:
• Nekton Foundation
• trusted IT providers
• cloud hosting providers
• CRM providers
• email communication platforms
• event management providers
• scientific publication partners
• professional advisers
• regulators
• law enforcement agencies where legally required
IX. International transfers
As an international scientific organisation, Ocean Census may transfer personal data outside the UK.
Where this occurs, Ocean Census will ensure appropriate safeguards are implemented, including:
• UK Adequacy Regulations
• International Data Transfer Agreement (IDTA)
• UK Addendum to Standard Contractual Clauses
• Other lawful transfer mechanisms permitted under UK GDPR
X. Data retention
Ocean Census maintains a separate Data Retention Schedule setting out how long different categories of information are retained.
Examples include:
| Record | Typical Retention |
| Financial records | 6–7 years |
| Recruitment records | 12 months |
| Event registrations | 2 years |
| Marketing preferences | Until withdrawn |
| Website analytics | 5 years |
| Ocean Census NOVA scientific attribution | Permanent |
Scientific attribution linked to species registrations forms part of the permanent scientific record and may therefore be retained indefinitely.
XI. Information security
Ocean Census will implement appropriate technical and organisational security measures, including:
• role-based access controls
• multi-factor authentication where appropriate
• encryption of devices and data where appropriate
• secure cloud storage
• password management
• regular software updates
• secure backups
• cyber security monitoring
• secure disposal of records
• confidentiality agreements
• staff training
Access to personal data will be limited to those who require it for legitimate business purposes.
XII. Individual rights
Individuals have the right to:
• access their information
• request correction
• request deletion where appropriate
• request restriction of processing
• object to processing
• request data portability (where applicable)
• withdraw consent
• complain to the Information Commissioner’s Office
Requests should be sent to:
Data Protection Lead: enquiries@oceancensus.org
Ocean Census will normally respond within one month.
Where appropriate we may request proof of identity before responding.
XIII. Data breaches
All actual or suspected personal data breaches must be reported immediately to the Data Protection Lead.
Ocean Census will:
• investigate the incident
• assess the risks
• maintain a breach register
• notify the ICO within 72 hours where legally required
• notify affected individuals where there is a high risk to their rights and freedoms
• implement corrective actions
XIV. Roles and responsibilities
Board of Trustees: Responsible for overall governance and ensuring appropriate resources are available.
Chief Operating Officer: Responsible for organisational compliance.
Data Protection Lead
Responsible for:
• monitoring compliance
• advising colleagues
• maintaining policies
• responding to rights requests
• coordinating breach management
• maintaining Records of Processing Activities
(If Ocean Census is legally required to appoint a statutory Data Protection Officer under UK GDPR, references in this policy should be amended accordingly.)
Managers: Responsible for ensuring staff comply with this policy.
All Staff and Volunteers
Must:
• comply with this policy
• complete mandatory data protection training
• report breaches immediately
• protect confidential information
XV. Monitoring and review
Compliance with this policy will be monitored periodically.
The policy will be reviewed at least every two years, or sooner where required by:
• legislative changes
• ICO guidance
• organisational change
• significant incidents
• audit findings
Join the census
The Ocean Census Alliance unites national and philanthropic marine institutes, museums, and universities, backed by governments, philanthropy, business and civil society partners.
